PIPEDA may not Apply to Information Collected to Defend a Lawsuit

A recent decision by the Office of the Privacy Commissioner of Canada (OPC) has confirmed that personal information collected or used in the course of defending a lawsuit is exempt from the Personal Information Protection and Electronic Documents Act (PIPEDA).¹ In making its finding, the OPC applied a Federal Court decision, which held that such collection of evidence is protected by litigation privilege and is not a “commercial activity” contemplated by PIPEDA—even if third parties are retained to carry out or conduct that activity on the defendant’s behalf. ²

What You Need To Know

• The ruling confirms that access to personal information remains heavily restricted when protected by privilege.
• PIPEDA does not provide a plaintiff in a civil action with access rights to personal information that is collected by a defendant in order to defend the claim—the collection of evidence and defending against a lawsuit are not considered private-sector commercial activity subject to PIPEDA.
• The above applies even when a third party (such as an expert) is retained to collect and use the personal information.
• However, parties to civil litigation—and their lawyers—should not assume that this ruling eliminates their obligations to safeguard personal information collected in the course of litigation.
• Private-sector organizations should continue to consider PIPEDA when making decisions about the protection of personal information obtained for the purpose of litigation.

Background and Implications for Civil Litigation

The OPC’s decision dealt with an access request filed by the plaintiff in a motor vehicle accident lawsuit. Under PIPEDA, the plaintiff requested access to his personal information that was collected on behalf of the defendant’s insurance company as part of an independent medical evaluation. The plaintiff was unsatisfied with the redacted copy of the report provided to him, filing a complaint with the OPC. Applying the 2010 Federal Court decision in State Farm, the OPC concluded that the matter was outside its jurisdiction because the collection of evidence in litigation is not commercial activity.

It is arguable that in other cases, the OPC could find that PIPEDA applies to personal information collected for litigation purposes, but an individual’s right of access to that information is limited because the records are subject to privilege. For example, a law firm defending a case on behalf of its client is engaging in commercial activity, and one could expect the OPC to enforce the firm’s obligation to protect personal information. However, one would also expect the OPC to recognize that the law firm has no obligation to provide an individual—who is adverse in interest to its client—with access to personal information included in case records that are subject to solicitor-client or litigation privilege.

Regardless of whether the OPC may revisit its position on whether PIPEDA applies to litigation in future cases, its recent decision confirms that access rights will be strictly limited when personal information is protected by privilege. While parties, lawyers and litigation service providers may take comfort that privileged information cannot be obtained through access requests under PIPEDA, private-sector organizations should continue to consider PIPEDA when making decisions about the protection of personal information obtained for the purpose of litigation.